mirror of
https://github.com/github/codeql.git
synced 2026-01-26 21:02:58 +01:00
24 lines
881 B
XML
24 lines
881 B
XML
<!DOCTYPE qhelp PUBLIC
|
|
"-//Semmle//qhelp//EN"
|
|
"qhelp.dtd">
|
|
<qhelp>
|
|
<overview>
|
|
<p>A call to the input() function, <code>input(prompt)</code> is equivalent to <code>eval(raw_input(prompt))</code>. Evaluating user input without any checking can be a serious security flaw.</p>
|
|
|
|
</overview>
|
|
<recommendation>
|
|
|
|
<p> Get user input with <code>raw_input(prompt)</code> and then validate that input before evaluating. If the expected input is a number or
|
|
string, then <code>ast.literal_eval()</code> can always be used safely.</p>
|
|
|
|
|
|
</recommendation>
|
|
<references>
|
|
|
|
<li>Python Standard Library: <a href="http://docs.python.org/library/functions.html#input">input</a>,
|
|
<a href="http://docs.python.org/library/ast.html#ast.literal_eval">ast.literal_eval</a>.</li>
|
|
<li>Wikipedia: <a href="http://en.wikipedia.org/wiki/Data_validation">Data validation</a>.</li>
|
|
|
|
</references>
|
|
</qhelp>
|